Bug 1584921 - Rust 1.26 match ergonomics allow improper &mut aliasing
Summary: Rust 1.26 match ergonomics allow improper &mut aliasing
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: DevTools
Classification: Red Hat
Component: rust
Version: rust-toolset-7
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: 2018.3
Assignee: Josh Stone
QA Contact: Edjunior Barbosa Machado
Vladimír Slávik
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-06-01 00:06 UTC by Josh Stone
Modified: 2018-07-16 14:21 UTC (History)
6 users (show)

Fixed In Version: rust-toolset-7-rust-1.26.2-3.el7
Doc Type: No Doc Update
Doc Text:
undefined
Clone Of:
Environment:
Last Closed: 2018-07-16 14:21:44 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Github rust-lang rust issues 51117 0 None None None 2018-06-01 00:06:57 UTC
Red Hat Product Errata RHEA-2018:2196 0 None None None 2018-07-16 14:21:49 UTC

Description Josh Stone 2018-06-01 00:06:57 UTC
Upstream: https://github.com/rust-lang/rust/issues/51117

The given example code should not be accepted, as "baz" borrows from "bar" -- the latter should be inaccessible until the former goes out of scope.  Since this isn't properly enforced, a use-after-free becomes possible in safe code.

    fn main() {
        let mut foo = Some("foo".to_string());
        let bar = &mut foo;
        match bar {
            Some(baz) => {
                bar.take();
                println!("{:?}", baz); // UAF, segfaults or prints garbage
            },
            None => unreachable!(),
        }
    }

More analysis upstream, and fixed in https://github.com/rust-lang/rust/pull/51235

There will likely be a 1.26.2 release just to address this, so if possible I'd like to simply update to that:  https://github.com/rust-lang/rust/pull/51258

Comment 5 errata-xmlrpc 2018-07-16 14:21:44 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:2196


Note You need to log in before you can comment on or make changes to this bug.